Skip to content
OpenAdvisories
Critical ICSA-26-027-04 1 CVE

Johnson Controls Metasys Products

Published Jan 27, 2026 · Updated Jan 27, 2026

Vendor: Johnson Controls Product: Metasys Application and Data Server (ADS) Product: Metasys Controller Configuration Tool (CCT) Product: Metasys Extended Application and Data Server (ADX) Product: Metasys LCS8500 Product: Metasys NAE8500 Product: Metasys System Configuration Tool (SCT)

Summary

Successful exploitation of this vulnerability could result in remote SQL execution, leading to alteration or loss of data.

Vulnerabilities 1

  • Critical 9.5
    CVE-2025-26385

    Metasys product command injection vulnerability could allow remote SQL execution

    Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects  * Metasys…

    Johnson Controls Metasys

Revision history

  1. #1

    Initial Republication of Johnson Controls advisory JCI-PSA-2026-02

References